Korn Ferry (KFY) Risk Analysis

We are subject to numerous laws and regulations, both within the U.S. and internationally, designed to protect client, colleague, supplier and company data, such as the GDPR, which requires companies to meet stringent requirements regarding the handling of personal data, including its use, protection and transfer and the ability of persons whose data is stored to correct or delete such data about themselves. Complying with the enhanced obligations imposed by laws, like the GDPR, has resulted and may continue to result in additional costs to our business and has required and may further require us to amend certain of our business practices. Failure to meet the various legal and regulatory requirements could result in significant penalties, including fines up to 4% of annual worldwide revenue. These laws may also confer a private right of action on certain individuals and associations. Laws and regulations in this area are evolving and generally becoming more stringent. State legislatures and regulators across the globe and here in the U.S. have significantly amplified their focus on data privacy and cybersecurity regulations this year, reflecting the growing public concern over data security. For instance, within the U.S. in calendar year 2024, a number of new state privacy laws were enacted, and we expect that other states will continue to adopt legislation in this area. The U.S. Department of Justice ("DOJ") became a relatively new regulator of sensitive data this year with the release of its rule regarding transfers of bulk U.S. sensitive personal data to certain "countries of concern." In addition, enforcement of privacy and data protection laws has increased over the last calendar year. For example, the California Privacy Protection Agency ("CPPA") issued its first-ever enforcement advisory reaffirming core principles of the California Consumer Protection Act ("CCPA"), including data minimization. Other countries have amended their privacy laws to bring them in line with international regulations, such as the GDPR. As these laws continue to evolve, we may be required to make changes to our services, solutions and/or products so as to enable the Company and/or our clients to meet the new legal requirements, including by taking on more onerous obligations in our contracts, limiting our storage, transfer and processing of data and, in some cases, limiting our service and/or solution offerings in certain locations. Changes in these laws, or the interpretation and application thereof, may also increase our potential exposure through significantly higher potential penalties for non-compliance. The costs of compliance with, and other burdens imposed by, such laws and regulations and client demand in this area may limit the use of, or demand for, our services, solutions and/or products, make it more difficult and costly to meet client expectations, or lead to significant fines, penalties or liabilities for noncompliance, any of which could adversely affect our business, financial condition, and results of operations. In addition, due to the uncertainty and potentially conflicting interpretations of these laws, it is possible that such laws and regulations may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other rules or our practices. Any failure or perceived failure by us to comply with applicable laws or satisfactorily protect personal information could result in governmental enforcement actions, litigation, or negative publicity, any of which could inhibit sales of our services, solutions and/or products. Further, enforcement actions and investigations by regulatory authorities related to data security incidents and privacy violations continue to increase. It is possible that future enactment of more restrictive laws, rules or regulations and/or future enforcement actions or investigations could have an adverse impact on us through increased costs or restrictions on our businesses and noncompliance could result in regulatory penalties and significant legal liability.

We cannot guarantee that trade secrets, trademark and copyright law protections are adequate to deter misappropriation of our IP (which has become an important part of our business). Existing laws of some countries in which we provide services or products may offer only limited protection of our IP rights. Redressing infringements may consume significant management time and financial resources. Also, we cannot detect all unauthorized use of our IP and take the necessary steps to enforce our rights, which may have a material adverse impact on our business, financial condition or results of operations. We cannot be sure that our services and products, or the products of others that we offer to our clients, do not infringe on the IP rights of third parties, and we may have infringement claims asserted against us or our clients. These claims may harm our reputation, result in financial liability and prevent us from offering some services or products.

We use information technology and other computer resources to carry out operational and marketing activities and to maintain our business records. We rely on information technology systems to process, transmit, and store electronic information and to communicate among our locations around the world and with our clients, partners, and employees. The breadth and complexity of this infrastructure increases the risk of security incidents resulting in the unauthorized disclosure of sensitive or confidential information and other adverse consequences that could have a material adverse impact on our business and results of operations. Our reliance on trained professionals to configure and operate this infrastructure creates the potential for human error, leading to potential exposure of sensitive or confidential information. Our systems and networks and the vendors who provide us services are vulnerable to incidents, including physical and electronic break-ins, attacks by hackers, computer viruses, malware, worms, router disruption, sabotage or espionage, ransomware attacks, supply chain attacks, disruptions from unauthorized access and tampering (including through social engineering such as phishing attacks), employee error and misconduct, impersonation of authorized users and coordinated denial-of-service attacks. We have experienced and may again in the future experience cybersecurity incidents resulting from unauthorized access to our systems, which over the past decade have not had a material impact on our business or results of operations; however, there is no assurance that such impacts will not be material in the future. Cyberattacks using AI are increasing, enabling automated phishing exploits and dynamic malware. These advancements pose challenges for traditional defense controls, emphasizing the need for new strategies and tools to protect against these threats. We expect cybersecurity incidents to continue to occur in the future. The continued occurrence of high-profile data breaches against various entities and organizations provides evidence of an external environment that is increasingly hostile to information security. This environment demands that we regularly improve our design and coordination of security controls across our business groups and geographies in order to protect information that we develop or that is obtained from our clients, candidates and employees. Despite these efforts, given the ongoing and increasingly sophisticated attempts to access the information of entities, our security controls over this information, our training of employees, and other practices we follow have not and may not prevent the improper disclosure of such information. Our efforts and the costs incurred to bolster our security against attacks cannot provide absolute assurance that future data breaches will not occur. We depend on our overall reputation and brand name recognition to secure new engagements. Perceptions that we do not adequately protect the privacy of information could inhibit attaining new engagements and/or qualified consultants and could potentially damage currently existing client relationships. Further, unauthorized use or misuse of AI by the Company's employees, vendors or others may result in disclosure of confidential company and customer data, reputational harm, privacy law violations and legal liability. The Company's use of AI may also lead to novel and urgent cybersecurity risks, including access to or the misuse of personal data, all of which may adversely affect its operations and reputation.

We continue to face significant competition within each of our services and product offerings. The human resource consulting market has been traditionally fragmented and a number of large consulting firms, such as AON, Deloitte, McKinsey, Mercer and Willis Towers Watson have built businesses in human resource consulting to serve these needs. Our consulting business line has and continues to face competition from human resource consulting businesses. Many of these competitors are significantly larger than Korn Ferry and have considerable resources at their disposal, allowing for potentially significant investment to grow their human resource consulting business. Digital products in the human resource market have been traditionally fragmented and a number of firms such as AON, Eightfold, Hogan, Mercer, SHL, Richardson/Challenger, Willis Towers Watson and other boutique HR technology firms offer competitive products. Competitors in the digital marketplace are a combination of large, well-capitalized firms and niche players who have received multiple rounds of private financing. Increased competition, whether as a result of professional and social networking website providers, traditional executive search firms, sole proprietors and in-house human resource professionals (as noted above) or larger consulting firms building human resources consulting businesses, may lead to pricing pressures that could negatively impact our business. For example, increased competition could require us to charge lower prices, and/or cause us to lose market share, each of which could reduce our fee revenue. Our executive search services face competition from both traditional and non-traditional competitors that provide job placement services, including other large global executive search firms, smaller specialty firms and web-based firms. We also face increased competition from sole proprietors and in-house human resource professionals whose ability to provide job placement services has been enhanced by professional profiles made available on the internet and enhanced social media-based search tools. The continued growth of the shared economy and related freelancing platform sites may also negatively impact demand for our services by allowing employers seeking services to connect with employees in real time and without any significant cost. Traditional executive search competitors include Egon Zehnder, Heidrick & Struggles International, Inc., Russell Reynolds Associates and Spencer Stuart. In each of our markets, one or more of our competitors may possess greater resources, greater name recognition, lower overhead or other costs and longer operating histories than we do, which may give them an advantage in obtaining future clients, capitalizing on new technology and attracting qualified professionals in these markets. Additionally, specialty firms can focus on regional or functional markets or on particular industries and executive search firms that have a smaller client base are subject to fewer off-limits arrangements. There are no extensive barriers to entry into the executive search industry and new recruiting firms continue to enter the market. We believe the continuing development and increased availability of information technology will continue to attract new competitors, especially web-enabled professional and social networking website providers, and these providers may be facilitating a company's ability to insource their recruiting capabilities. Competitors in these fields include Google for Jobs, HireVue, iCIMS, Indeed, Jobvite, Phenom, SmashFly and Yello. As these providers continue to evolve, they may develop offerings similar to or more expansive than ours, thereby increasing competition for our services or more broadly causing disruption in the executive search industry. Further, as technology continues to develop and the shared economy continues to grow, we expect that the use of freelancing platform sites will become more prevalent. As a result, companies may turn to such sites for their talent needs, which could negatively impact demand for the services we offer. Our RPO services primarily compete for business with other RPO providers such as Alexander Mann Solutions, Allegis, Cielo, IBM, Randstad and WilsonHCG while Professional Search & Interim services compete for mid-level professional search assignments with regional contingency recruitment firms and large national retained recruitment firms such as BTG, Harvey Nash, KForce, Michael Page, Robert Half, Robert Walters and TekSystems. In addition, some organizations have developed or may develop internal solutions to address talent acquisition that may be competitive with our solutions. This is a highly competitive and developing industry with numerous specialists. To compete successfully and achieve our growth targets for our talent acquisition business, we must continue to support and develop assessment and analytics solutions, maintain and grow our proprietary database, deliver demonstrable return on investment to clients, support our products and services globally, and continue to provide consulting and training to support our assessment products. Our failure to compete effectively could adversely affect our operating results and future growth.

Should we experience a disaster or other business continuity problem, such as a natural disaster, unusual weather conditions, terrorist attack, security breach, power loss, telecommunications failure or other man-made disaster, our continued success will depend, in part, on the availability of our personnel, our office facilities, and the proper functioning of our computer, telecommunication and other related systems and operations. In such an event, we could experience near-term operational challenges with regard to particular areas of our operations. In particular, our ability to recover from any disaster or other business continuity problem will depend on our ability to protect our technology infrastructure against damage from business continuity events that could have a significant disruptive effect on our operations. For example, a large number of our corporate staff are based in California, which has a high level of risk from wildfires and earthquakes. The impacts of climate change may present risks, including damage to assets and technology caused by extreme weather events and may otherwise heighten or exacerbate the occurrence of such weather events. We could potentially lose client data or experience material adverse interruptions to our operations or delivery of services to our clients in a disaster. A disaster on a significant scale or affecting certain of our key operating areas within or across regions, or our inability to successfully recover should we experience a disaster, pandemic or other business continuity problem, could materially interrupt our business operations and cause material financial loss, loss of human capital, regulatory actions, reputational harm, damaged client relationships or legal liability.

A material portion of our revenue and expenses are generated by our operations in foreign countries, and we expect that our foreign operations will account for a material portion of our revenue and expenses in the future. Most of our international expenses and revenue are denominated in foreign currencies. As a result, our financial results are affected by changes in foreign currency exchange rates or weak economic conditions in foreign markets in which we have operations, among other factors. Global events, including political instability, international conflicts, trade disputes, economic sanctions, inflation, increasing interest rates and emerging market volatility, and the resulting uncertainties, may cause foreign currency exchange rates to fluctuate in relation to the U.S. dollar. Fluctuations in the value of those currencies in relation to the U.S. dollar have caused and will continue to cause dollar-translated amounts to vary from one period to another. Such variations expose us to both adverse as well as beneficial movements in currency exchange rates. Given the volatility of exchange rates, we are not always able to manage effectively our currency translation or transaction risks, which has and may continue to adversely affect our financial condition and results of operations.